CVE-2025-46653: Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content

The vulnerability description clearly states that Formidable relied on hexoid for generating filenames and that hexoid is not cryptographically secure. I analyzed two provided commits (022c2c5577dfe14d2947f10909d81b03b6070bf5 and 37a3e89fca1ed68ec674a539f13aafd62221ddaa) which both patch this vulnerability. Both commits modify the src/Formidable.js file.

In this file, the IncomingForm class has a method (assigned as a property in the constructor or as a class method, effectively _getNewName) that was responsible for generating new filenames. The patches show that the call to toHexoId() (which was initialized using hexoid) within _getNewName was replaced by a call to createId() (which uses @paralleldrive/cuid2, a more secure alternative).

This directly points to IncomingForm._getNewName as the function that contained the vulnerable code (the use of hexoid for filename generation). The purpose of this function aligns perfectly with the vulnerability description. The patch directly replaces the insecure call within this function, confirming it as the site of the vulnerability.